HootBoard Plugin Unauthenticated Stored XSS via REST Endpoints

The HootBoard WordPress plugin through 3.1.4 does not perform any authorisation check on some of its REST endpoints, and does not escape the values stored through them before outputting them in a public page, allowing unauthenticated users to inject arbitrary web scripts that will execute in the browser of anyone visiting that page, including administrators.

Casky was already ahead

This CVE exploits attack patterns that Casky's 323matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

The HootBoard WordPress plugin through version 3.1.4 contains a critical stored cross-site scripting (XSS) vulnerability that combines two dangerous flaws: missing authorization checks on REST endpoints and inadequate output escaping. This allows unauthenticated attackers to inject malicious JavaScript through unprotected API endpoints, which is then stored and executed in the browsers of all page visitors—including administrators with elevated privileges. Any WordPress site running the affected plugin version becomes a vector for session hijacking, credential theft, malware distribution, and administrative account compromise, making this a high-severity supply chain risk affecting the entire WordPress ecosystem.

Casky's 323 matched security skills leverage Claude's extended reasoning to detect this vulnerability pattern across the MITRE ATT&CK framework, primarily mapping to TA0001 (Reconnaissance) and TA0043 (Reconnaissance for attack planning). Practitioners using Casky would identify attack chains showing unauthenticated REST endpoint probing (T1592 - Gather Victim Identity Information), stored payload injection techniques (T1190 - Exploit Public-Facing Application), and subsequent privilege escalation when admin sessions interact with poisoned content. The platform's skill-based analysis would surface suspicious REST requests lacking authentication headers, payloads with HTML/JavaScript encoding bypasses, and stored malicious content reaching public-facing pages—enabling security teams to detect both exploitation attempts and post-compromise artifacts before widespread exposure occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

323 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-86798.

Abuse of Public-Facing API: Mobile API Abuse

mobile security · low

Run

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-86798

Casky has 323 skills that investigate the attack patterns behind CVE-2026-86798. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn